This invention relates to a detector for detecting, in real time, the failure of a real time digital clock in a modular redundant clock system, and which has the ability to self-check itself to detect an internal fault.
In the most common form of modular redundancy, three identical processors or machines are employed in a triple modular redundancy (TMR) configuration in which the processors work synchronously on the same task and their outputs are voted by hardware or software to provide a majority answer. For reliability and efficiency, real time clocking of the processors is preferably provided by employing a fault-tolerant hardware clock system comprising three redundant synchronized clock circuits and a majority voter to permit continued correct system operation with the loss of less than a majority of the clock circuits. This is possible because of the masking action of the majority voter. However, in a TMR system, if one clock circuit fails the system cannot tolerate a second failure. Accordingly, it is desirable to employ a detector for indicating that a failure has occurred so that proper remedial action may be taken. Moreover, the detector should also be capable of verifying that the failure was not within itself.
Although self-checking detectors are known, these detectors typically use special codes or special bit patterns for self-checking. Error checking of majority voters in TMR systems has been accomplished by exercising the voter with specific output levels from the three redundant channels corresponding to all possible combinations of two one's and a zero, and reading the voter output for verification of correct operation. This type of checking substantially increases the software overhead of the system, and is also not in real time in the sense that the checking may only be performed at specified intervals. This type of checking is not feasible for the modular redundant clock system which must run uninterrupted.
It is desirable to provide a self-checking detector for a modular redundant clock system which avoids these and other disadvantages of known detectors, and it is to this end that the present invention is directed.